NetApp AltaVault Cloud Integrated Storage Administration Guide
107
Beta Draft
Configuring AltaVault appliances for FIPS-compliant cryptography Configuring AltaVault appliances for FIPS-compliant cryptography
2.
Enter the following set of commands:
amnesiac > enable
amnesiac # configure terminal
amnesiac (config) # show fips status
FIPS Mode: Enabled
The output indicates if FIPS mode is enabled and displays any warnings for features that affect FIPS compliance. If
no warnings appear and FIPS mode is enabled, your system is FIPS compliant. If warnings appear, you need to make
configuration changes to achieve full compliance.
You cannot review FIPS compliance from the Management Console; however, if you attempt to configure features that
affect FIPS compliance through the Management Console when in FIPS mode, the Web interface produces an error
message warning you of the conflict.
Working with features to maintain FIPS compliance
It is the responsibility of the system administrator of AltaVault appliance to ensure the system is FIPS compliant. Not
all features can be operated in a FIPS-compliant manner and they need to be disabled when in FIPS mode. Some
features can be operated in a FIPS-compliant manner by following noted guidance and other features prevent you from
entering into FIPS mode.
The system generates a warning message if you configure non-compliant features. You can view the warning messages
with the
show fips status
command.
The following sections describe configurable features that can affect FIPS compliance and describe how to resolve the
warnings. The system does not prevent you from using noncompliant features in FIPS mode, but the system does warn
you that they are not FIPS compliant. (The exception is account passwords; you cannot enable FIPS mode if all account
passwords do not use compliant encryption).
Note:
The commands in the following sections are configuration commands. You need to run these from configuration mode in the
CLI. For detailed information, see the
NetApp AltaVault Cloud Integrated Storage Command-Line Reference Guide
.
Account passwords
FIPS compliance requires that passwords for user accounts are encrypted using an SHA256-based or SHA512-based
hash.
In systems with RCSM, SHA512 is the default hash when creating and updating a user password. However, previous
releases used MD5 encryption. So, when you upgrade to a software release supporting FIPS mode from a release with
MD5-based passwords, the MD5 passwords remain in the configuration.
If you attempt to enter FIPS mode on a system with accounts that have MD5 passwords, you see the following error:
amnesiac (config) # fips enable
% User admin has a password hashed using a non-FIPS-allowed hash.
The password(s) must be changed before FIPS mode can be enabled.
The error message identifies the user accounts that need to be updated; in this example, the admin account. You must
update the noncompliant passwords or delete the accounts before you can enable FIPS mode. From the CLI, enter the
username <username> password <password>
command to change passwords.
Summary of Contents for AltaVault AVA400
Page 2: ...Beta Draft ...
Page 10: ...Beta Draft Contents ...
